This Data Processing Addendum ("DPA") forms part of the Terms of Service between FormSubmit ("Processor") and the account holder ("Controller") and applies to personal data contained in form submissions ("Customer Data").
1. Subject matter and duration
The Processor processes Customer Data to provide the service for as long as the Controller's account is active, and deletes it according to the Controller's retention settings or on account closure.
2. Nature and purpose
Receiving, storing, filtering, transmitting (by email and to integrations configured by the Controller) and deleting form submissions and uploaded files.
3. Categories of data and data subjects
Data subjects are people who submit the Controller's forms. Categories are determined by the Controller's form fields and may include contact details, messages and files, plus technical metadata (hashed IP, user agent, referrer).
4. Processor obligations
The Processor will:
- process Customer Data only on documented instructions from the Controller, including the configuration of forms and integrations;
- ensure personnel with access are bound by confidentiality;
- implement appropriate technical and organisational measures, including encryption in transit and at rest, encryption of integration secrets, private file storage, access controls and audit logging of administrative access;
- assist the Controller with data subject requests and data protection impact assessments where reasonable;
- notify the Controller without undue delay after becoming aware of a personal data breach;
- delete or return Customer Data at the end of the service.
5. Sub-processors
The Controller authorises the use of sub-processors for hosting, database, file storage, email delivery and payments. The Processor will inform the Controller of changes and impose equivalent data protection obligations on sub-processors.
6. International transfers
Where Customer Data is transferred outside the EEA/UK, the parties rely on the applicable standard contractual clauses or another lawful transfer mechanism.
7. Integrations
When the Controller enables an integration (for example Slack, Google Sheets or a webhook), Customer Data is transmitted to that third party on the Controller's instruction; that third party is not a sub-processor of FormSubmit.
Contact
To request a countersigned copy, email support@formsubmit.app.